← 研踪 PaperTrailarXiv:2606.15461 · v2
ESBMC-PLC: Formal Verification of IEC 61131-3 Ladder Diagram Programs Using SMT-Based Model Checking
首次提交 2026-06-14 04:39
版本更新 2026-10-29 06:57
雷达观测 2026-10-30 11:25
摘要
Ladder diagram (LD) is the relay-circuit language of IEC 61131-3 in which many PLC safety interlocks are written, and model checkers built on SMT solvers do not read it. A verdict reached through a translation is only as good as that translation. We present ESBMC-PLC, which verifies LD programs with the ESBMC model checker, and argue that its translation is faithful. It encodes the scan cycle as a single loop with nondeterministic inputs, resolves graphical PLCopen XML networks into ordered rungs, models timers in milliseconds, and rejects programs outside an explicit subset. We prove, under eight stated hypotheses, that one iteration of the emitted loop agrees with one scan of a semantics for the subset, so scan-count verdicts on programs without user function blocks hold on that semantics. For timing-mode verdicts, a refinement theorem for MATIEC's timers gives evidence, not proof. One SMT query per program also compares the emitted loop with the C that MATIEC generates. On the 241 labeled LD variants of a public benchmark suite, ESBMC-PLC returns no wrong verdict against the current labels and proves 127 variants safe; ESBMC on MATIEC's C for the same programs proves 2. PLCverif with NuSMV, which shares neither our frontend nor ESBMC, agrees with ESBMC-PLC on all 207 of the 208 variants within the theorem's scope that it can run. On 413 LD programs from public GitHub repositories, none of the 104 that the per-program query can check differs from MATIEC. Every k-induction proof closes at k = 2. ESBMC's inductive step proves only properties that one scan preserves, so properties that depend on a longer history stay unproved.
作者备注：30 pages, 7 figures, 16 tables. Substantially revised version; supersedes the earlier evaluation
观测到的版本
相邻记录可能跳过中间版本；首次发现 v2 及以上也会标为版本更新。
v2 · 2026-10-29 06:57 · 最新观测版本
ESBMC-PLC: Formal Verification of IEC 61131-3 Ladder Diagram Programs Using SMT-Based Model Checking
Ladder diagram (LD) is the relay-circuit language of IEC 61131-3 in which many PLC safety interlocks are written, and model checkers built on SMT solvers do not read it. A verdict reached through a translation is only as good as that translation. We present ESBMC-PLC, which verifies LD programs with the ESBMC model checker, and argue that its translation is faithful. It encodes the scan cycle as a single loop with nondeterministic inputs, resolves graphical PLCopen XML networks into ordered rungs, models timers in milliseconds, and rejects programs outside an explicit subset. We prove, under eight stated hypotheses, that one iteration of the emitted loop agrees with one scan of a semantics for the subset, so scan-count verdicts on programs without user function blocks hold on that semantics. For timing-mode verdicts, a refinement theorem for MATIEC's timers gives evidence, not proof. One SMT query per program also compares the emitted loop with the C that MATIEC generates. On the 241 labeled LD variants of a public benchmark suite, ESBMC-PLC returns no wrong verdict against the current labels and proves 127 variants safe; ESBMC on MATIEC's C for the same programs proves 2. PLCverif with NuSMV, which shares neither our frontend nor ESBMC, agrees with ESBMC-PLC on all 207 of the 208 variants within the theorem's scope that it can run. On 413 LD programs from public GitHub repositories, none of the 104 that the per-program query can check differs from MATIEC. Every k-induction proof closes at k = 2. ESBMC's inductive step proves only properties that one scan preserves, so properties that depend on a longer history stay unproved.
查看此版本解读 →查看此版本原文 ↗